diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 993dded..ac0c386 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -6,7 +6,7 @@ variables:
   #DATADOG_AGENT_BUILDERS: v9930706-ef9d493
   DATADOG_AGENT_BUILDERS: v47979770-a5a4cfd0
   S3_CP_CMD: aws s3 cp --only-show-errors --region us-east-1 --sse AES256
-  SCRIPT_VERSION: 13
+  SCRIPT_VERSION: 14
 
 deploy:
   #image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/datadog-agent-builders/gitlab_agent_deploy:$DATADOG_AGENT_BUILDERS
diff --git a/README.md b/README.md
index 7158c9e..aecef9f 100644
--- a/README.md
+++ b/README.md
@@ -21,11 +21,13 @@ DD_CIVISIBILITY_INSTRUMENTATION_LANGUAGES=... DD_API_KEY=... ./install_test_visi
 The script parameters are
 
 - `DD_CIVISIBILITY_INSTRUMENTATION_LANGUAGES`: (required) List of languages to be instrumented. Can be either `all` or any of `java`, `js`, `python`, `dotnet`, `ruby`, `go` (multiple languages can be specified as a space-separated list).
-- `DD_API_KEY`: (required for .NET tracer installation) Datadog API key. Can be found at https://app.datadoghq.com/organization-settings/api-keys
+- `DD_API_KEY`: (required for .NET tracer installation) Datadog API key. Can be found at <https://app.datadoghq.com/organization-settings/api-keys>
 - `DD_TRACER_FOLDER`: (optional) The folder where the tracing libraries will be installed, defaults to `./.datadog`
-- `DD_SITE`: (optional) Datadog site, defaults to US1. See https://docs.datadoghq.com/getting_started/site for more information about sites.
+- `DD_SITE`: (optional) Datadog site, defaults to US1. See <https://docs.datadoghq.com/getting_started/site> for more information about sites.
 - `DD_SET_TRACER_VERSION_DOTNET`: (optional) Version of the .NET tracer to install. If not provided, the latest version is installed.
 - `DD_SET_TRACER_VERSION_JAVA`: (optional) Version of the Java tracer to install (without the `v` prefix, e.g. `1.37.1`). If not provided, the latest version is installed.
+- `DD_SET_TRACER_REPOSITORY_URL_JAVA`: (optional) Base URL of a Maven repository (or proxy/mirror) used to download the Java tracer JAR and its `.sha256`. The path under the base must follow the standard Maven layout for `com.datadoghq:dd-java-agent` (i.e. `<base>/<version>/dd-java-agent-<version>.jar`, plus `<base>/maven-metadata.xml` when `DD_SET_TRACER_VERSION_JAVA` is not pinned). Trailing slashes are tolerated. Defaults to `https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent`.
+- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer <token>`). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. Redirects are not followed when this option is set, to avoid forwarding credentials to another location; configure `DD_SET_TRACER_REPOSITORY_URL_JAVA` as the final repository URL.
 - `DD_SET_TRACER_VERSION_JS`: (optional) Version of the JS tracer to install. If not provided, the latest version is installed.
 - `DD_SET_TRACER_VERSION_PYTHON`: (optional) Version of the Python tracer to install. If not provided, the latest version is installed.
 - `DD_SET_COVERAGE_VERSION_PYTHON`: (optional) Version of the Python `coverage` package to install. Defaults to `7.13.5`.
diff --git a/install_test_visibility.sh b/install_test_visibility.sh
index 2d548ab..edd30e3 100755
--- a/install_test_visibility.sh
+++ b/install_test_visibility.sh
@@ -16,6 +16,8 @@ if ! mkdir -p $ARTIFACTS_FOLDER; then
   return 1
 fi
 
+DEFAULT_JAVA_TRACER_REPOSITORY_URL="https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent"
+
 extract_major_version() {
   echo "$1" | cut -d '.' -f 1
 }
@@ -25,8 +27,15 @@ extract_minor_version() {
 }
 
 install_java_tracer() {
+  if ! validate_java_auth_header_configuration; then
+    return 1
+  fi
+
+  local repository_base_url
+  repository_base_url="$(get_java_tracer_repository_base_url)"
+
   if [ -z "$DD_SET_TRACER_VERSION_JAVA" ]; then
-      DD_SET_TRACER_VERSION_JAVA=$(get_latest_java_tracer_version)
+      DD_SET_TRACER_VERSION_JAVA=$(get_latest_java_tracer_version "$repository_base_url")
   fi
 
   local filepath_tracer
@@ -34,8 +43,8 @@ install_java_tracer() {
   local filepath_checksum
   filepath_checksum="$ARTIFACTS_FOLDER/dd-java-agent.jar.sha256"
 
-  download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar" $filepath_tracer
-  download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar.sha256" $filepath_checksum
+  download_file "$repository_base_url/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar" "$filepath_tracer" "${DD_SET_AUTH_HEADER_JAVA:-}"
+  download_file "$repository_base_url/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar.sha256" "$filepath_checksum" "${DD_SET_AUTH_HEADER_JAVA:-}"
 
   if ! verify_checksum "$(cat $filepath_checksum)" "$filepath_tracer"; then
     return 1
@@ -74,6 +83,22 @@ install_java_tracer() {
   echo "DD_TRACER_VERSION_JAVA=$(command -v java >/dev/null 2>&1 && java -jar $filepath_tracer || unzip -p $filepath_tracer META-INF/MANIFEST.MF | grep -i implementation-version | cut -d' ' -f2)"
 }
 
+validate_java_auth_header_configuration() {
+  if [ -n "${DD_SET_AUTH_HEADER_JAVA:-}" ] && [ -z "${DD_SET_TRACER_REPOSITORY_URL_JAVA:-}" ]; then
+    >&2 echo "Error: DD_SET_AUTH_HEADER_JAVA requires DD_SET_TRACER_REPOSITORY_URL_JAVA to be set to a custom repository URL."
+    return 1
+  fi
+
+  if [ -n "${DD_SET_AUTH_HEADER_JAVA:-}" ]; then
+    local repository_base_url
+    repository_base_url="$(normalize_java_tracer_repository_base_url "$DD_SET_TRACER_REPOSITORY_URL_JAVA")"
+    if [ "$repository_base_url" = "$DEFAULT_JAVA_TRACER_REPOSITORY_URL" ]; then
+      >&2 echo "Error: DD_SET_AUTH_HEADER_JAVA cannot be used with the default Maven Central repository. Set DD_SET_TRACER_REPOSITORY_URL_JAVA to a custom repository URL."
+      return 1
+    fi
+  fi
+}
+
 verify_checksum() {
   if command -v sha256sum >/dev/null 2>&1; then
     if ! echo "$1 $2" | sha256sum --quiet -c -; then
@@ -89,14 +114,31 @@ verify_checksum() {
   fi
 }
 
+get_java_tracer_repository_base_url() {
+  local base_url="${DD_SET_TRACER_REPOSITORY_URL_JAVA:-$DEFAULT_JAVA_TRACER_REPOSITORY_URL}"
+  normalize_java_tracer_repository_base_url "$base_url"
+}
+
+normalize_java_tracer_repository_base_url() {
+  local base_url="$1"
+  # Trim trailing slashes so callers can append "/<version>/..." uniformly
+  # regardless of whether the override was provided with or without one.
+  while [ "${base_url%/}" != "$base_url" ]; do
+    base_url="${base_url%/}"
+  done
+  echo "$base_url"
+}
+
 get_latest_java_tracer_version() {
+  local repository_base_url="$1"
+
   local filepath_metadata
   filepath_metadata="$ARTIFACTS_FOLDER/maven-metadata.xml"
   local filepath_checksum
   filepath_checksum="$ARTIFACTS_FOLDER/maven-metadata.xml.sha256"
 
-  download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/maven-metadata.xml" $filepath_metadata
-  download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/maven-metadata.xml.sha256" $filepath_checksum
+  download_file "$repository_base_url/maven-metadata.xml" "$filepath_metadata" "${DD_SET_AUTH_HEADER_JAVA:-}"
+  download_file "$repository_base_url/maven-metadata.xml.sha256" "$filepath_checksum" "${DD_SET_AUTH_HEADER_JAVA:-}"
 
   if ! verify_checksum "$(cat $filepath_checksum)" "$filepath_metadata"; then
     return 1
@@ -113,10 +155,21 @@ get_latest_java_tracer_version() {
 download_file() {
   local url=$1
   local filepath=$2
+  local auth_header="${3:-}"
   if command -v curl >/dev/null 2>&1; then
-    curl -Lo "$filepath" "$url"
+    if [ -n "$auth_header" ]; then
+      # Do not follow redirects while sending a caller-provided secret header.
+      curl -Lo "$filepath" --max-redirs 0 -H "$auth_header" "$url"
+    else
+      curl -Lo "$filepath" "$url"
+    fi
   elif command -v wget >/dev/null 2>&1; then
-    wget -O "$filepath" "$url"
+    if [ -n "$auth_header" ]; then
+      # Do not follow redirects while sending a caller-provided secret header.
+      wget --max-redirect=0 -O "$filepath" --header="$auth_header" "$url"
+    else
+      wget -O "$filepath" "$url"
+    fi
   else
     >&2 echo "Error: Neither wget nor curl is installed."
     return 1